Kenya seeks new Data Commissioner to replace Kassait as PSC opens vacancy

The Public Service Commission (PSC) has opened applications for the position of Data Commissioner at the Office of the Data Protection Commissioner (ODPC), setting the stage for Kenya to appoint a new holder of the position created under the country's data protection law.

In a notice calling for applications to positions in the public service, the PSC listed the Data Commissioner position under vacancy, with the application deadline set for September 14, 2026.

The commission said details of the position and application procedure are available through its website and cautioned applicants against fraudsters soliciting money while posing as PSC officials.

"Beware of fraudsters soliciting for bribes from the public while masquerading as Commission staff. Public Service Commission does not charge any fee for job applications, shortlisting, interviews or appointments."

The vacancy is at the independent government agency responsible for overseeing the protection of personal data and enforcing privacy rights in Kenya.

The Office of the Data Protection Commissioner was established under the Data Protection Act, 2019, which was enacted in November 2019.

It became operational in November 2020, when Kenya's first Data Commissioner assumed office.

The creation of the office gave institutional effect to Kenya's data protection framework and the constitutional right to privacy under Article 31 of the Constitution.

The Data Commissioner serves a single, non-renewable six-year term, according to the profile information provided for the office.

The position has been held since its creation by Immaculate Kassait, who was appointed in November 2020.

Kassait is a lawyer who holds a Bachelor of Laws degree from Makerere University, a Post Graduate Diploma in Law from the Kenya School of Law and a Global Executive Master of Business Administration from the United States International University-Africa.

She is an Advocate of the High Court of Kenya with more than 14 years of legal practice and was conferred the rank of Senior Counsel (SC) in December 2025. She is also a recipient of the Moran of the Order of the Burning Spear (MBS).

Before becoming Data Commissioner, Kassait spent nearly 11 years at the Independent Electoral and Boundaries Commission (IEBC), where she served as Director of Voter Registration and Electoral Operations.

She also chaired the taskforce that developed regulations intended to operationalise the Data Protection Act after its enactment.

The ODPC is responsible for enforcing the Data Protection Act across public and private entities that process personal information.

Among its functions is establishing and maintaining a public register of data controllers and data processors operating in Kenya.

The office also receives and investigates complaints from individuals who believe their privacy or data protection rights have been violated.

The Data Commissioner has powers to undertake compliance inspections and audits of data processing operations, as well as issue enforcement notices and impose administrative penalties against organisations found to be non-compliant.

The office is also mandated to promote public awareness about data protection and educate individuals and organisations on their rights and obligations concerning personal information.

It also advises the government on policy and legislative matters relating to data protection and privacy.

The ODPC has progressively expanded its operations beyond its Nairobi headquarters, with regional offices established in locations including Mombasa, Nakuru, Kisumu, Eldoret, Nyeri and Garissa.

The information provided on the office says the regulator has registered more than 15,000 entities and handled thousands of complaints as Kenya's data protection regime has expanded.

Also, the office participates in regional data protection initiatives. Kassait serves as First Vice Chair of the Board of the Network of African Data Protection Authorities (NADPA).

The creation of the ODPC followed the enactment of Kenya's comprehensive data protection framework in 2019, replacing an environment in which there was no single dedicated regulator responsible for overseeing personal-data protection.

The law established obligations for organisations collecting and processing personal information and created mechanisms through which individuals can exercise their privacy rights.